CVE-2024-47806: High severity jenkins openid connect authentication plugin vulnerability

Published Oct 2, 2024
·
Updated

Jenkins OpenId Connect Authentication Plugin 4.354.v321ce67a1de8 and earlier does not check the aud (Audience) claim of an ID Token during its authentication flow, a value to verify the token is issued for the correct client.

This vulnerability may allow attackers to subvert the authentication flow, potentially gaining administrator access to Jenkins.

OpenId Connect Authentication Plugin 4.355.v3afbfcab96d4 checks the aud (Audience) claim of an ID Token during its authentication flow.

Other sources

Jenkins OpenId Connect Authentication Plugin 4.354.v321ce67a1de8 and earlier does not check the aud (Audience) claim of an ID Token, allowing attackers to subvert the authentication flow, potentially gaining administrator access to Jenkins.

MITRE

Affected Software

2 affected componentsFixes available
maven/org.jenkins-ci.plugins:oic-auth<4.355.v3a
4.355.v3a
jenkins Openid Connect Authentication Jenkins<4.355.v3a_fb_fca_b_96d4

Event History

Oct 2, 2024
CVE Published
via MITRE·03:35 PM
Data Sourced
via MITRE·03:35 PM
Description
Data Sourced
via NVD·04:15 PM
DescriptionSeverityWeakness
Advisory Published
via GitHub·06:31 PM

Frequently Asked Questions

1

What is the severity of CVE-2024-47806?

CVE-2024-47806 has a medium severity level due to its potential to subvert authentication processes.

2

How do I fix CVE-2024-47806?

To fix CVE-2024-47806, upgrade the Jenkins OpenId Connect Authentication Plugin to version 4.355.v3a or later.

3

What types of systems are affected by CVE-2024-47806?

CVE-2024-47806 affects Jenkins installations using versions of the OpenId Connect Authentication Plugin up to 4.354.v321ce67a_1de8.

4

What is the main issue with CVE-2024-47806?

The main issue with CVE-2024-47806 is that it does not validate the 'aud' claim in the ID Token, potentially allowing token misuse.

5

Can CVE-2024-47806 be exploited remotely?

Yes, CVE-2024-47806 can be exploited remotely if an attacker has the ability to issue a valid ID Token without the appropriate audience validation.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203